e2e: integration harness (69/69 green) + fix /agent/ws missing bearer auth (BUG-1)

e2e/scenarios/session-list.mjs

@@ -0,0 +1,38 @@
+// scenarios/session-list.mjs — every connected web client gets session_list
+// broadcasts on session state changes (agent hello / disconnect), including a
+// client that subscribed after the session already existed.
+
+import { agentClient, agentHello, sessionSnapshot, sid, webClient } from "../lib.mjs";
+
+export async function run(ctx) {
+  const { r, token, agentUrl, webUrl } = ctx;
+  const id = sid("e2e-list");
+
+  const first = await webClient(webUrl, token);
+  const initA = await first.waitForFrame((f) => f.type === "session_list");
+  r.check("first web client gets initial session_list", initA !== null);
+
+  const second = await webClient(webUrl, token);
+  const initB = await second.waitForFrame((f) => f.type === "session_list");
+  r.check("second web client gets initial session_list", initB !== null);
+
+  const agent = await agentClient(agentUrl, token);
+  await agentHello(agent, sessionSnapshot(id));
+  const onA = await first.waitForFrame(
+    (f) => f.type === "session_list" && f.sessions?.some((s) => s.id === id && s.online === true),
+  );
+  r.check("first client receives session_list on new session", onA !== null);
+  const onB = await second.waitForFrame(
+    (f) => f.type === "session_list" && f.sessions?.some((s) => s.id === id && s.online === true),
+  );
+  r.check("second subscriber also receives the broadcast", onB !== null);
+
+  agent.close();
+  const offlineB = await second.waitForFrame(
+    (f) => f.type === "session_list" && f.sessions?.some((s) => s.id === id && s.online === false),
+  );
+  r.check("session_list broadcast shows online=false after agent disconnect", offlineB !== null);
+
+  first.close();
+  second.close();
+}